90302a72d583dc589687650dfc0ec05c579e027e91f96f9603500cbc68840f9c

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ae1f4112aab1999022473274e984e57_JaffaCakes118.html
Size

18KB
MD5

0ae1f4112aab1999022473274e984e57
SHA1

74b08c4ba4bed50caadc141a9d222d282e101ac8
SHA256

90302a72d583dc589687650dfc0ec05c579e027e91f96f9603500cbc68840f9c
SHA512

9c10452d38a32d5cc6e1d2da2bbbf4dae886ae0b292faa3e81890bdb3076e6c9cd6f433c05efce29a9c49a85c637512fa7729030f530b1fb971e50b654596046
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIs4QzUnjBhsm82qDB8:SIMd0I5nvHlsvslxDB8

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E810681-075E-11EF-9B89-EA263619F6CB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420690658"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2880	iexplore.exe
2880	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2740	2880	iexplore.exe	28
PID 2880 wrote to memory of 2740	2880	iexplore.exe	28
PID 2880 wrote to memory of 2740	2880	iexplore.exe	28
PID 2880 wrote to memory of 2740	2880	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ae1f4112aab1999022473274e984e57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c3b0c03b509c46d55dc9a9b9dda7dc1

SHA1
13e47161a9417b50fa7f472af67c255dd3c212ac

SHA256
c8d28844f1efdfb3c96fab6a4904b4af4274c63a6456e477e1a0227080ef97f9

SHA512
6c72f0b23c5812bd243a236340917659bcc7283bd0723053cd865a50e6b5082ef1794e33d1400923b5e3fde54fbb0e9e0d9560f7290af9d5f91ae0bac03ed6d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6011570085f4d7f1d0425c2669ed615f

SHA1
67695012f022f4ec296be5933eae24697c12bb17

SHA256
50fcb6fd62327377c8cc749b04daf35aa11ce17eb024bf7f8d5ceb4b84041eb4

SHA512
6b13f37e226343126694be93f84014bfd081a2f4d79956f5294edd691f7f2d850982de51f5ca792356a76d6a6fa9e53c92c5e6f1dfdf2814c685c6d01050c328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5f7deb2d0e57686e18d5cc111eadb481

SHA1
44821e89c4fc50f4e426e12365b3b5a19d639aff

SHA256
519ecfe701fa72a7864ba27313de143e751bb5f422e5bc7678cb8eee6a7a54d1

SHA512
fc7457599124a73e5035c886925777b26aec479e80fb56deabb74dcd68b40f77a26b4537931b58e255286e4a3bcc087343e2593e48b1733e2f0a3c643db3b638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
de302f0ca92fd44b75b29b942f9303eb

SHA1
541ecbff24c10dceffcc4a739854ba5180a00b44

SHA256
a2ea5eaef420c4d7ad7e772ad3e85708fb2c66d622f7ac287473a925cbca2c15

SHA512
e1be2f96aa945e303ef52897c2a12de0f3f9371d95676c426dff8b2dac027fad439b5e21ee6e3c9be4ea8af3aed67d9d72d5b2ec6c82b2c589d145e3cdc09a00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50c5b70db3381211c0908d5eb6730ab4

SHA1
715d06e3b2f5bba5a879d1c03222addeb3235486

SHA256
29e0e91b8afadb9ea4f3491c1f4b6f7bc20d21c27b5e1628a2b13e4cdeba0982

SHA512
12f536ed9c12547ae20db5272527b1e397eee55e7df3ab8baf2c3f450749a1c9cfe58ef01bf3075e25b7677c1b54f68f6f859d4e0b2d0668727efeff8d2a7271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
31177d3f88573c2bd95f19f57ca2edca

SHA1
f8058ab4ecc2bbfc2e181786821d8919fa5fdcbf

SHA256
a3756b6701ad313d9274d05804ff7c0c017cfe4419a99fb0905c34630e50b791

SHA512
7d27a68876e66fa97b08bb0905c936935ecba98cc31ecf1b40e585251bcae950f065ab535e02f3ea9231ebca3e8be2e4946b695e55186c7b8d7914fa91895c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9011836746ad3a9fb0a854b6380e3ecf

SHA1
06b22c33a31fea53a73305be2d0ea5459b44afd6

SHA256
c8561adf5128ab443ea29ab7d19084e91223e68c60b38a26eabe92e1a3421641

SHA512
e95bc214ba00b16f25ed6e0b3ea5f2b1c8942ee03633c69f761901e4e4299d582660637c3c831404a43f2529c7e05ab8e46380e5b838308eeaf28659a97edd8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b66bcb1cde8c64bd8a6b2732d3cdd192

SHA1
fa930fcfdffd4232757a8fc13da947b84a5592bb

SHA256
947eec35f3a8a88b166d19581318ba625cfa0639cf03cf2c32447f4d3f183cea

SHA512
a0043bb0267dd71e229748445dc61b1d7a3d68997bce5bce8649da900528076c94d078014a6f1e4bb65af0f361c902241c4cf343f08f4020dd1cd02b95bf6b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
870f71e6910c7fe198316e2fb2d0b90e

SHA1
7112dd71183ac72de4204c074d4407f489fff910

SHA256
ad7ffd0794af3cc0c3b16ca6647d8e0848fe7df595aab082bef591804a88b037

SHA512
cb61c92e9716a1afa49468581ebabb26c559fb53f9ce0c2f2aefc0487b29d014202ce2e737a31f17769b3c74485a55c306dada2d95f41f1c0c0dca5d51a3ea26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab10E2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11A1.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11B6.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit